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Knock... 
usekeeping 
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At Least, They’re Supposed To 


http://toool. 
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You Don’t Want This to 


So Let’s Talk About Room 


Please 
Do Not 
Disturb 


ж Under Door Tool 
1 Dr 


Always Know 
Where Your 
. Towel Is 


TOWEL DAY " MAY 25 


The Solution - Always Know 
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Some People Want Extra 
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Some People Fail at Extra 
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El Attack with a Reach-Around, (.) 
НА Attack with a Rubber # 


A Different Type of Door 


A Different Type of Fail 


чі Attack with a Slap Tool 
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че! Attack with a Maid Sign 


Harder to do at Hotel Penn... 


“Statler 


Servidoor” 
first at Boston Park @а 


Modern Hotel Doors Often Do 


Peepholes are Supposed to be 


Have 


Security Consultants 


One Last Bit of Peephole Fun 
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One Last Bit of Peephole Fun 
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Let’s Say You Choose to Leave 


You May Take an Elevator 


Time to Stop all the Lies 
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Floor Lockout 


Gero 
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Floor Lockout 
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Who Left That Open? 
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What Have We Here? 


Dios Mio! Es La Migra! 
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Another Panel 
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CAB LIGHTS 
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Fire Service Mode 
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Fire Service Mode 


Fire Service Keys 


Fire Service Keys 
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Sometimes Keys Do Strange 


Keys in a Cabinet... One 


ven 


Heh, Such a Thing as Too 


More Keys Means More Access 


Lots of Noise Behind a Grill 


A Closer Look 


Cell Tower Equipment 


Another Service Log 


Another Service Log 


Another Service Log 


Let’s Get Back To The Room 


Keycard Access 


Disable the Card Reader 


We'll Revisit This Later, Too 


BTW... Does This Math Add 


We Don’t Think So 


Pin Matrix Room Keys 


Pin Matrix Lock 


Programmed With a Control 


Control Card “A” Installed 


00000 


Control Card Can “Wiggle” 


Pass Card “A” Being Used 


Change to Control Card “B” 


Understanding the Pin Matrix 


Ball Bearings On Top 


Pin Matrix Room Keys 
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This Control Card Would Never 
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At Least Need to Depress 
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Very Punched Control Card 


All Ball Bearings Free To Move 


A Solid Pass Key Would be 


€ VingCard 


The Solid Pass Key Pushes All 


и € VingCard 


Imagine The Reverse... A Solid 


All Pin Stacks are now 


This Pass Card Would be 


€ VingCard 


Ventilated Pass Card Works 


A More Typical Control Card 
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These Stacks are In Position 
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These Balls Shouldn’t Move 
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So... This Would be the 
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These Stacks Were Already In 


€ VingCard 
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Control-Card Based Attacks 


Dimpled Control-Card 


Ball Bearings Can Sit Lower 


“Cookie Tray” Control Card 


Ball Bearings Can Sit Lower 
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Pass Key 
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Pass Key 


Nada) 


Decoding and Picking Attacks? 


Consider This Ball Bearing 


Very Springy 


Consider This Ball Bearing 


Not Nearly as Springy 


You May Have Guessed... No 


No Master Keying Means 


Override Lock... Sometimes 


Override Lock... Sometimes 


Override Lock... Sometimes 


Override Lock... Sometimes 


Magnetic Locks Also Feature 


Magnetic Hotel Keys 


Magnetic Hotel Keys 


start | site |room key | “ma | expir | expi | end neci: 
bit | code | num | num | gic” e те | bit | sum 
ber | ber | num | date |time 
ber 
;0000 | 0420 | 0069 01 0016 | 20100 | 1200 | 999 CRC 
00 720 


start | site |room| key | “ma | ехріг | expi | end neci: 
bit | code | num | num | gic” e те | bit | sum 
ber | ber | num | date |time 
ber 
;0000 | 0420 | 0069 01 0016 | 20100 | 1200 | 999 CRC 
00 720 
;0000 | 0420 | 0069 0016 | 20100 | 1200 | 999 CRC 


start | site |room| key | “ma | ехріг | expi | end hack 
bit | code | num | num | gic” e re | bit (um 
ber | ber | num | date | time 


Magnetic Hotel Keys 
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bit | code | num | пит 
ber ber | num | date 


(last 100 такт: 


Special Hotel Keys 


start | site |room| key | “ma | ехріг | expi | end Баас 
bit | code | num | num | gic” e re | bit (um 
ber | ber | num | date | time 
ber 
30000 | 0420 01 20100 | 1200 | 999 CRC 
00 820 


ecial Hotel Keys 


start | site |room| key | “ma | ехріг | expi | end Баас 
bit | code | пит | num | gic” e re | bit (um 
ber | ber | num | date | time 
ber 
;0000 | 0420 | 0000 01 0000 1200 | 999 CRC 
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Special Hotel Keys 


Special Hotel Keys 
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Special Thanks 


Major 


Malfunction 
Über Hacker 
Extraordinaire 
From The U.K. 
- Yet Loves Firearms 
- Not a Nanny-State- 


Loving Nancy 


Come Visit the Lockpick 


Thank You Very Much! 


The Open Pet of Lockpickers 
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